On this page

CWE-552: Files or Directories Accessible to External Parties

Weakness Summary

The product makes files or directories accessible to unauthorized actors, even though they should not be.

  • Canonical source: MITRE CWE-552
  • Published Atomicorp CVE observations: 22
  • Distinct affected products in those observations: 21
  • Active Atomicorp rules associated with this weakness: 24

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2017-14942Intelbras WRN 150 - Authentication Bypasswrn150Protected by Atomicorp rules390716
CVE-2026-21589Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Readjira,confluence,bitbucketProtected by Atomicorp rules340024
CVE-2026-34361HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Thefthl7 fhir coreProtected by Atomicorp rules337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022
CVE-2009-10005ContentKeeper Web Appliance mimencode File AccessWeb ApplianceProtected by Atomicorp rules344360 , 347009
CVE-2021-4463Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File DownloadBEMS APIProtected by Atomicorp rules344360 , 347009 , 390709
CVE-2024-6911PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File InclusionprocessplusProtected by Atomicorp rules344365 , 347019
CVE-2026-53580Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featuretriliumProtected by Atomicorp rules340007 , 347009
CVE-2017-16651Roundcube TimeZone Authenticated File DisclosurewebmailProtected by Atomicorp rules340007 , 344360 , 390709
CVE-2020-17519Apache Flink JobManager TraversalflinkProtected by Atomicorp rules347009 , 390709
CVE-2021-39316WordPress DZS Zoomsounds <=6.50 - Local File InclusionzoomsoundsProtected by Atomicorp rules340007 , 344360 , 347009 , 390709
CVE-2021-40150Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosuree1 zoom firmwareProtected by Atomicorp rules390716
CVE-2022-0656uDraw <3.3.3 - Local File Inclusionweb to print shop\Protected by Atomicorp rules344360 , 390709
CVE-2022-2627174cmsSE v3.4.1 - Arbitrary File Read74cmsProtected by Atomicorp rules340007
CVE-2022-33901WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Readmultisafepay plugin for woocommerceProtected by Atomicorp rules340748 , 344360 , 347006 , 347009 , 390709
CVE-2023-2766Weaver OA 9.5 - Information Disclosureweaver office automationProtected by Atomicorp rules390716
CVE-2025-11371Gladinet CentreStack/Triofox Path TraversalcentrestackProtected by Atomicorp rules340007 , 344360 , 344365 , 347009 , 347019 , 390709
CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeanyqueryProtected by Atomicorp rules340007 , 344360 , 347009 , 390709
CVE-2026-88623NUUO Network Video Recorder 2.0.0 Files or Directories Accessible to External Parties Vulnerability-Protected by Atomicorp rules340007 , 344360 , 390709
CVE-2025-68109ChurchCRM Database Restore RCE 6.2.0churchcrmProtected by Atomicorp rules330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904
CVE-2026-29066TinaCMS - Path TraversaltinacmsProtected by Atomicorp rules347009 , 390709
CVE-2021-40149Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosuree1 zoomProtected by Atomicorp rules390716
CVE-2022-25497Cuppa CMS v1.0 - Local File InclusioncuppacmsProtected by Atomicorp rules340007 , 344360 , 390709

Associated Atomicorp WAF Rules

RuleStatusBehavior
330791Activedisruptive (deny)
334168Activedisruptive (deny)
337109Activedisruptive (deny)
337110Activedisruptive (deny)
340007Activedisruptive (deny)
340024Activedisruptive (deny)
340128Activedisruptive (deny)
340152Activedisruptive (deny)
340162Activedisruptive (deny)
340163Activedisruptive (deny)
340748Activedisruptive (deny)
344360Activedisruptive (deny)
344365Activedisruptive (deny)
347006Activedisruptive (deny)
347009Activedisruptive (deny)
347019Activedisruptive (deny)
360152Activedisruptive (deny)
380018Activedisruptive (deny)
390709Activedisruptive (deny)
390716Activedisruptive (deny)
390801Activedisruptive (deny)
390904Activedisruptive (deny)
398021Activedisruptive (deny)
398022Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-150 , CAPEC-639